{ "Event": { "analysis": "1", "date": "2026-06-22", "extends_uuid": "", "info": "[Threat Intel] An unknown actor distributes malicious VBS scripts via WhatsApp", "protected": false, "publish_timestamp": "1782537015", "published": true, "threat_level_id": "3", "timestamp": "1782537001", "uuid": "ef37da5f-f14c-4d52-88ff-af1dfd7fccd9", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#0088cc", "local": false, "name": "misp-galaxy:producer=\"Kaspersky\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#d74cce", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Bypass User Account Control - T1548.002\"", "relationship_type": "" }, { "colour": "#47d9d3", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"", "relationship_type": "" }, { "colour": "#7d7034", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": "" }, { "colour": "#a92e1c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": "" }, { "colour": "#e00500", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote Access Tools - T1219\"", "relationship_type": "" }, { "colour": "#bf01b7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Modify Registry - T1112\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#356c41", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#98f3da", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Visual Basic - T1059.005\"", "relationship_type": "" }, { "colour": "#4c0fbb", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"", "relationship_type": "" }, { "colour": "#44b2c2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Hidden Files and Directories - T1564.001\"", "relationship_type": "" }, { "colour": "#b990dd", "local": false, "name": "misp-galaxy:target-information=\"Australia\"", "relationship_type": "" }, { "colour": "#c94db5", "local": false, "name": "misp-galaxy:target-information=\"Brazil\"", "relationship_type": "" }, { "colour": "#013748", "local": false, "name": "misp-galaxy:target-information=\"India\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:target-information=\"Malaysia\"", "relationship_type": "" }, { "colour": "#d52b43", "local": false, "name": "misp-galaxy:target-information=\"Mexico\"", "relationship_type": "" }, { "colour": "#15cd0b", "local": false, "name": "misp-galaxy:target-information=\"Russia\"", "relationship_type": "" }, { "colour": "#7dbb86", "local": false, "name": "misp-galaxy:target-information=\"Singapore\"", "relationship_type": "" }, { "colour": "#f439e5", "local": false, "name": "misp-galaxy:target-information=\"Spain\"", "relationship_type": "" }, { "colour": "#2613b0", "local": false, "name": "misp-galaxy:target-information=\"Taiwan\"", "relationship_type": "" }, { "colour": "#ce59f1", "local": false, "name": "misp-galaxy:target-information=\"United Kingdom\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#dd2e44", "local": false, "name": "rectifyq:MY-relevancy=\"relevant\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:online-service=\"01031d3f-c9c9-4288-bb58-234c38e4246e\"", "relationship_type": "" }, { "colour": "#a3aa59", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1193\"", "relationship_type": "" }, { "colour": "#5539fe", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-tool=\"BITSAdmin - S0190\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-tool=\"certutil - S0160\"", "relationship_type": "" }, { "colour": "#755c09", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"", "relationship_type": "" }, { "colour": "#7a946e", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1086\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:software-vendor=\"WhatsApp\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:rmm-tool=\"ManageEngine\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:operating-system=\"Windows\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782183608", "to_ids": false, "type": "link", "uuid": "62d5316f-53f0-46fe-9be3-c8f96043d421", "value": "https://securelist.com/whatsapp-vbs-rmm-campaign/120290/" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1782183608", "to_ids": false, "type": "text", "uuid": "36d20e01-c02b-4d2a-a133-f2621c77db48", "value": "An active malware campaign has been discovered distributing malicious VBScript files through WhatsApp direct messages since June 2026. The operation affects users across multiple countries, with Malaysia experiencing the highest concentration of victims. Attackers compromise WhatsApp accounts and send weaponized VBS files disguised as business and financial documents to contacts. The multi-stage infection chain ultimately deploys legitimate ManageEngine Endpoint Central RMM software, providing persistent remote access to compromised systems. The scripts employ heavy obfuscation, Chinese-language comments, and modify Windows UAC settings. Infrastructure overlaps with ValleyRAT and Gh0st RAT operations suggest possible Chinese-speaking operators, though attribution remains uncertain. The campaign primarily targets individual users through opportunistic rather than focused methods, exploiting social engineering techniques with localized filenames in multiple languages." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1782183608", "to_ids": false, "type": "text", "uuid": "ddb0927c-a2f4-4e35-ae57-007b264cb457", "value": "Name: An unknown actor distributes malicious VBS scripts via WhatsApp\nAuthor: AlienVault\nAdversary: \nTags: [\"uac bypass\", \"valleyrat\", \"gh0st rat\", \"rmm abuse\", \"multi-stage infection\", \"social engineering\", \"whatsapp\", \"manageengine endpoint central\", \"vbscript\", \"chinese-speaking operator\"]\nTgtd countries: [\"Australia\", \"Brazil\", \"British Indian Ocean Territory\", \"India\", \"Malaysia\", \"Mexico\", \"Russian Federation\", \"Singapore\", \"Spain\", \"Taiwan\", \"United Kingdom of Great Britain and Northern Ireland\"]\nMlwr families: [\"ValleyRAT\", \"gh0st RAT - S0032\", \"Mydoor\", \"Moudoor\"]\nAttack_ids: [\"T1047\", \"T1548.002\", \"T1204.002\", \"T1566.002\", \"T1082\", \"T1140\", \"T1219\", \"T1070.006\", \"T1112\", \"T1553.005\", \"T1218.005\", \"T1027\", \"T1573\", \"T1071.001\", \"T1059.005\", \"T1574.002\", \"T1105\", \"T1564.001\", \"T1564.004\"]\nIndustries: []" }, { "category": "Network activity", "comment": "Attacker-controlled UEMS server IP Address", "deleted": false, "disable_correlation": false, "timestamp": "1782536956", "to_ids": true, "type": "ip-dst", "uuid": "6ed3b4a4-8ad3-499c-91a7-a62e376982ab", "value": "202.61.160.201", "Tag": [ { "colour": "#dd0399", "local": false, "name": "asn:asn=\"152194\"", "relationship_type": "" }, { "colour": "#8c0628", "local": false, "name": "asn:as-owner=\"CTGSERVERLIMITED-AS-AP CTG Server Limited\"", "relationship_type": "" }, { "colour": "#fbf8fb", "local": false, "name": "asn:as-country=\"HK\"", "relationship_type": "" }, { "colour": "#daa28c", "local": false, "name": "misp-galaxy:country=\"hong kong\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Ghost RAT\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"ValleyRAT\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Attacker-controlled UEMS server IP Address", "deleted": false, "disable_correlation": false, "timestamp": "1782445847", "to_ids": true, "type": "ip-dst", "uuid": "bc5a1003-78dc-4a95-9be2-454eff1fcce7", "value": "202.61.160.137", "Tag": [ { "colour": "#dd0399", "local": false, "name": "asn:asn=\"152194\"", "relationship_type": "" }, { "colour": "#8c0628", "local": false, "name": "asn:as-owner=\"CTGSERVERLIMITED-AS-AP CTG Server Limited\"", "relationship_type": "" }, { "colour": "#fbf8fb", "local": false, "name": "asn:as-country=\"HK\"", "relationship_type": "" }, { "colour": "#daa28c", "local": false, "name": "misp-galaxy:country=\"hong kong\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Attacker-controlled UEMS server IP Address", "deleted": false, "disable_correlation": false, "timestamp": "1782445868", "to_ids": true, "type": "ip-dst", "uuid": "c1e50090-c6f5-4dd6-b915-55a1b6b47eec", "value": "202.61.160.160", "Tag": [ { "colour": "#dd0399", "local": false, "name": "asn:asn=\"152194\"", "relationship_type": "" }, { "colour": "#8c0628", "local": false, "name": "asn:as-owner=\"CTGSERVERLIMITED-AS-AP CTG Server Limited\"", "relationship_type": "" }, { "colour": "#fbf8fb", "local": false, "name": "asn:as-country=\"HK\"", "relationship_type": "" }, { "colour": "#daa28c", "local": false, "name": "misp-galaxy:country=\"hong kong\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Attacker-controlled UEMS server IP Address", "deleted": false, "disable_correlation": false, "timestamp": "1782445889", "to_ids": true, "type": "ip-dst", "uuid": "5ba32877-8767-4af1-b725-f2ec81ddbef6", "value": "202.61.160.202", "Tag": [ { "colour": "#dd0399", "local": false, "name": "asn:asn=\"152194\"", "relationship_type": "" }, { "colour": "#8c0628", "local": false, "name": "asn:as-owner=\"CTGSERVERLIMITED-AS-AP CTG Server Limited\"", "relationship_type": "" }, { "colour": "#fbf8fb", "local": false, "name": "asn:as-country=\"HK\"", "relationship_type": "" }, { "colour": "#daa28c", "local": false, "name": "misp-galaxy:country=\"hong kong\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Attacker-controlled UEMS server IP Address", "deleted": false, "disable_correlation": false, "timestamp": "1782445910", "to_ids": true, "type": "ip-dst", "uuid": "048ced3b-9fec-42b5-8668-855b0fbc0719", "value": "202.61.160.208", "Tag": [ { "colour": "#dd0399", "local": false, "name": "asn:asn=\"152194\"", "relationship_type": "" }, { "colour": "#8c0628", "local": false, "name": "asn:as-owner=\"CTGSERVERLIMITED-AS-AP CTG Server Limited\"", "relationship_type": "" }, { "colour": "#fbf8fb", "local": false, "name": "asn:as-country=\"HK\"", "relationship_type": "" }, { "colour": "#daa28c", "local": false, "name": "misp-galaxy:country=\"hong kong\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Attacker-controlled UEMS server IP Address", "deleted": false, "disable_correlation": false, "timestamp": "1782445931", "to_ids": true, "type": "ip-dst", "uuid": "f82fa502-febd-4af7-b881-f47a0426f7de", "value": "38.55.151.63", "Tag": [ { "colour": "#3d465e", "local": false, "name": "asn:asn=\"400619\"", "relationship_type": "" }, { "colour": "#a21a3b", "local": false, "name": "asn:as-owner=\"AROSS-AS\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782445952", "to_ids": true, "type": "domain", "uuid": "6efa075a-eb87-4bd7-9463-0a0f6fb00db6", "value": "baoxis.cc", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782445973", "to_ids": true, "type": "hostname", "uuid": "f507a078-ab9e-49d2-9953-67d1757b72f8", "value": "invoice.msopsa.top", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782445994", "to_ids": true, "type": "hostname", "uuid": "a24d2082-0ca7-49f3-b2d2-aad8330a3547", "value": "temu.baskwms.top", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782446015", "to_ids": true, "type": "hostname", "uuid": "1407dcf3-f266-4e76-823a-b24265c236f3", "value": "qse.shoppes.help", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782446037", "to_ids": true, "type": "domain", "uuid": "d080026a-9297-440c-9d66-ab788d45ceb8", "value": "shaaslong.one", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782446058", "to_ids": true, "type": "hostname", "uuid": "0600bfe6-91d0-4418-8956-8d6ce89a26e3", "value": "baolongwes.oss-ap-southeast-1.aliyuncs.com", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782446079", "to_ids": true, "type": "hostname", "uuid": "f4601a8d-9717-4830-8cdd-29fc1c72a83e", "value": "sdcwww.oss-ap-southeast-1.aliyuncs.com", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782446101", "to_ids": true, "type": "hostname", "uuid": "1b95eba9-6f15-48d6-af30-27df0aad9a6b", "value": "baoyuw2s.s3.ap-southeast-1.amazonaws.com", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782446122", "to_ids": true, "type": "hostname", "uuid": "0efc17d5-7362-4eee-be8e-758f4fc0e52c", "value": "hksha3.s3.ap-southeast-1.amazonaws.com", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782446143", "to_ids": true, "type": "hostname", "uuid": "23a4d51f-4ac4-4b09-9349-c88175c9d09a", "value": "sjdkjj23.s3.ap-southeast-1.amazonaws.com", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782446165", "to_ids": true, "type": "hostname", "uuid": "8d1f0eee-560f-4c48-a30f-eb07312789ef", "value": "xijkwm2.s3.ap-southeast-1.amazonaws.com", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782446187", "to_ids": true, "type": "hostname", "uuid": "d6d862da-82a2-4109-9a9a-fd51ac613667", "value": "yifubafu.s3.ap-southeast-1.amazonaws.com", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782446208", "to_ids": true, "type": "hostname", "uuid": "3c6d39fa-8af2-4660-a91b-015762f64bd0", "value": "caiwuascw.s3.us-east-005.backblazeb2.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782446229", "to_ids": true, "type": "hostname", "uuid": "b23467e1-6a27-4486-93f6-15da98c6431b", "value": "facaia.s3.us-east-005.backblazeb2.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782446250", "uuid": "d126cd23-4be1-4853-8d0a-6f3f1e53fe1c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782446250", "to_ids": true, "type": "md5", "uuid": "459b2841-7056-4662-a98c-aa211a7fcb00", "value": "02bb20455cc592a69c080abac770ce90", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782445562", "to_ids": true, "type": "sha1", "uuid": "08de1e84-f44e-4500-85c4-5156803810f2", "value": "f0fde01b1e36503227252f6cb6b3b075f93a2c1a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782445562", "to_ids": true, "type": "sha256", "uuid": "1d4b9e95-454f-4806-8357-e0c7327dc3ab", "value": "452259dc297f56cf22c7932e8fbcefe821ef9c3127134074fae585f89355d397", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782444124", "to_ids": true, "type": "ssdeep", "uuid": "b2de5a4d-7b0b-4300-8c3e-03269795ea30", "value": "96:1yklADAifBq29pPa0J0mnzRag//FQR5SCHLj50LM/+B/KZ/R1/Bjfz3/v3N5zCd:gk90EQZum/FUuo/+B/Y/R1/57/v9VCd" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782444124", "to_ids": false, "type": "size-in-bytes", "uuid": "f7ccb8bc-ebb7-4b77-b55f-573fc51264bf", "value": "6971" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782444124", "to_ids": true, "type": "vhash", "uuid": "7b76062a-e7e6-401c-bee6-0262f7ec1df2", "value": "73797b3e3da4a3b31684ddb8228c22a3" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782444124", "to_ids": true, "type": "filename", "uuid": "0bc3d3d4-e220-4182-959f-985e8370de3d", "value": "download.php" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 25/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782444124", "to_ids": false, "type": "text", "uuid": "b3044ffb-223b-4c9f-a8a5-dddd648d5187", "value": "Type Description: VBA\nMicrosoft: TrojanDownloader:VBS/Obfuse.NWA!MTB\nVT Total Detection:31/61\nFirst Submission:2026-04-03T10:08:05.000000+00:00\nLast Submission:2026-04-03T10:08:05.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782446271", "uuid": "c87ca7c0-7425-4a4b-90ec-6edd7cf39983", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782446271", "to_ids": true, "type": "md5", "uuid": "8c5809da-0406-4b9b-bf08-51a943fc3776", "value": "31037a42ca048e06e69a78f55bc2eff5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782445564", "to_ids": true, "type": "sha1", "uuid": "51fdd5ff-9c58-4caf-b725-ee7b42f509d3", "value": "887ec87e4a19759cad25d4bc0956d2b965d3041d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782445564", "to_ids": true, "type": "sha256", "uuid": "5528bd74-d03e-4a3a-8b45-f2ed0fb6b167", "value": "50c74b468c217776b8890b841baefec8b196b14083a7873a9201c838a8e4c90a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782444146", "to_ids": true, "type": "ssdeep", "uuid": "cfd7ecc3-3e7d-46ad-9218-2d657e52172e", "value": "192:gdX0EQoudR3lZDJuo/H/W/OUwD7xXr9VC8:gBl2NfVKwD7xf/" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782444146", "to_ids": false, "type": "size-in-bytes", "uuid": "c1f9aab7-0207-4c80-ac5b-0ec29cc9c4a2", "value": "6400" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782444146", "to_ids": true, "type": "vhash", "uuid": "eee9156a-9873-4a7d-a728-11e03a68355a", "value": "4a960e3e5e9b8c6386157cec779286c2" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782444146", "to_ids": true, "type": "filename", "uuid": "bb653633-327d-4fd7-ac67-d167bfc3c46d", "value": "1122.vbs" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 25/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782444146", "to_ids": false, "type": "text", "uuid": "4d634132-03fa-4de5-8637-f38ef752d2d0", "value": "Type Description: VBA\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:30/61\nFirst Submission:2026-04-03T12:33:20.000000+00:00\nLast Submission:2026-04-03T12:33:20.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782446292", "uuid": "a6645646-db5b-41af-8968-007f162d708e", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782446292", "to_ids": true, "type": "md5", "uuid": "5a345618-68a2-4a95-8a78-7c9ed3cae00e", "value": "05d188f071d097f5b6bd8138749b4b14", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782445565", "to_ids": true, "type": "sha1", "uuid": "d6c940fe-5eaa-4cb6-9a58-f446a583d3d0", "value": "30a8b8108ae02c5fff7853970ec13bb9698e3101", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782445565", "to_ids": true, "type": "sha256", "uuid": "19def3c8-3d43-4780-bc9d-6e9517716e12", "value": "2223cc6687d89a5273041e5410948a852536ed8b63d67a8cec9e0fdae884cb64", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782444168", "to_ids": true, "type": "ssdeep", "uuid": "e8ea5497-35a8-4550-912d-5e91520422a0", "value": "1536:8ODs2xM/mLXzAjMPFv0MGMrgZOADzleyFcUHXuAhNmY0hLAv:Z3fal+o" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782444168", "to_ids": false, "type": "size-in-bytes", "uuid": "547bce3f-39df-4454-8f8f-f9a6332df67a", "value": "72856" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782444168", "to_ids": true, "type": "vhash", "uuid": "aae23796-9e0f-435a-a51d-9e1db1c13783", "value": "e5db8e293c4b886b4742405bbb1e1f1e" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782444168", "to_ids": true, "type": "filename", "uuid": "efb8f4b0-b337-4364-bfb4-446666b76ab4", "value": "Penyata bank.vbs" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 24/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782444168", "to_ids": false, "type": "text", "uuid": "14102f77-99bf-4e95-8e63-d1ed4648895c", "value": "Type Description: VBA\nMicrosoft: Trojan:Script/Wacatac.B!ml\nVT Total Detection:26/60\nFirst Submission:2026-06-15T08:20:07.000000+00:00\nLast Submission:2026-06-15T08:20:07.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782446313", "uuid": "633e1ab1-1b85-4d3c-8d3e-d33a5f384a7b", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782446313", "to_ids": true, "type": "md5", "uuid": "988deb32-8980-4df2-b2c3-a031968a082e", "value": "0ba93109757776a44de9d8c88baa4963", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782445567", "to_ids": true, "type": "sha1", "uuid": "d24abd7a-3294-4142-9017-99e5183dac1e", "value": "8abda4175aae868765c175469469102b503cb0c4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782445567", "to_ids": true, "type": "sha256", "uuid": "09cc9467-e6fd-4e5f-810a-ffb887edbf18", "value": "0d3d531a8fae455a0676ef4408a683c8af0671fd589bb6106aff4637439d73a7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782444189", "to_ids": true, "type": "ssdeep", "uuid": "c968c31b-88c3-411f-b5a5-4243b16d5b93", "value": "96:fA+JvOn3vDKJTIBBSf4bGffTh7n632zMSuO6pT/8l6XVWxR/4/T1/jPAsw:fJKC2BZGzh7n63SMUWRl8/4/T1/jPM" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782444189", "to_ids": false, "type": "size-in-bytes", "uuid": "4bf0940d-2fa6-409e-8016-34734d3861a5", "value": "7146" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782444189", "to_ids": true, "type": "vhash", "uuid": "f001b86d-291e-4646-bcde-41eb92e9ab9b", "value": "3a399ff26a811036a2781440155438a0" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782444189", "to_ids": true, "type": "filename", "uuid": "ea46f1ba-36d1-4c20-ae50-f5fad425cbf8", "value": "Financial Reports(C1).vbs" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 24/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782444189", "to_ids": false, "type": "text", "uuid": "367defec-6bd6-4b0c-b514-bc32cc392289", "value": "Type Description: VBA\nMicrosoft: Trojan:Win32/Malgent\nVT Total Detection:25/60\nFirst Submission:2026-06-09T03:15:24.000000+00:00\nLast Submission:2026-06-09T03:15:24.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782446334", "uuid": "5bbd00c0-b7b5-4f68-a824-38952502122f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782446334", "to_ids": true, "type": "md5", "uuid": "f6d10efb-fc9b-48d2-9b56-e9aa16cc9342", "value": "1a3cc75466ffb1971482f7abf7aabc3f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782445568", "to_ids": true, "type": "sha1", "uuid": "f4039d9a-28c7-4ac6-bd9c-c2f4f94e5323", "value": "f4ba0315829853714c2dada2611ee0390d14fe16", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782445568", "to_ids": true, "type": "sha256", "uuid": "e8fb040e-f46f-40f9-b2b5-ddeb6ca9bf17", "value": "07f4130e0a52e8c63d8c3dcc989eb185161ea917a9c45900692fdf031af13ab1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782444211", "to_ids": true, "type": "ssdeep", "uuid": "c0ec2b2d-f128-42e6-9652-ebe6fb6533a9", "value": "192:gtmNdY0/9SJUxy/0qjQh2FUeJU/qVauF/f/7A/egUwbO4PgQCf:gANdncJUxymaU/SaMJ3wb/1Q" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782444211", "to_ids": false, "type": "size-in-bytes", "uuid": "84fd7b5c-19c2-4cf4-96a1-1038e1d8f90c", "value": "8990" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782444211", "to_ids": true, "type": "vhash", "uuid": "ffd08fbf-c976-4bf3-948b-64e9d67f82c9", "value": "ffbb3f25f1f05a6af0ae5e99cdee7fb8" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782444211", "to_ids": true, "type": "filename", "uuid": "492aed5a-252e-4088-8096-4928e36d52d8", "value": "home3.vbs" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 24/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782444211", "to_ids": false, "type": "text", "uuid": "b29c12ba-adb6-450c-b73a-2fff06e5666f", "value": "Type Description: VBA\nMicrosoft: Trojan:Script/Wacatac.C!ml\nVT Total Detection:27/60\nFirst Submission:2026-04-17T04:44:51.000000+00:00\nLast Submission:2026-04-17T04:44:51.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782446355", "uuid": "39b0f201-01f4-44ce-91f7-a98f7412d8fb", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782446355", "to_ids": true, "type": "md5", "uuid": "35bc85cb-706e-4be0-901c-bdd818f8046e", "value": "1c47c63e5ed25060d95359c57c77b107", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782445569", "to_ids": true, "type": "sha1", "uuid": "3f5879c3-9bac-488c-801a-a00de21b28c0", "value": "080c27e996e40cdfad30fbb7c880ce1341e156eb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782445569", "to_ids": true, "type": "sha256", "uuid": "d4d92d1f-c652-4730-8112-14e4f6ffb93c", "value": "845d8887ec023255c9896d1644c821168c33b5e8426519228ab3003715fe19dc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782444233", "to_ids": true, "type": "ssdeep", "uuid": "f83ee4f5-b637-4379-b931-172e8631e5f4", "value": "96:1DA+/CEUxmfg4myTgM889R/nRD/3c/hsO+hs01g2QqUiVS:5/P5XTgM883/n5/s/SOMs0ghD" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782444233", "to_ids": false, "type": "size-in-bytes", "uuid": "4ac98cea-df82-4e70-9632-5f7f67aa429a", "value": "5510" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782444233", "to_ids": true, "type": "vhash", "uuid": "20c2fb28-e68b-4411-8492-677b2e508245", "value": "89e071c49383d25de784cbbe7a0ff8d2" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782444233", "to_ids": true, "type": "filename", "uuid": "5ab3a5a5-e867-4080-8502-e86589de0ac9", "value": "zipats.vbs" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 25/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782444233", "to_ids": false, "type": "text", "uuid": "a9cf019b-3d1a-4894-816a-2c2e623b6a9c", "value": "Type Description: VBA\nMicrosoft: Trojan:Win32/Egairtigado!rfn\nVT Total Detection:28/61\nFirst Submission:2026-06-09T09:57:12.000000+00:00\nLast Submission:2026-06-09T09:57:12.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782446376", "uuid": "2be7b927-4c9c-4cae-b7ba-97f88bbd66dc", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782446376", "to_ids": true, "type": "md5", "uuid": "ece2eb83-6e5f-4c93-88b5-6c5abf98eefb", "value": "1d94fbe9cab21278cc3f104bea334d08", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782445571", "to_ids": true, "type": "sha1", "uuid": "3de3b354-dd3a-47bd-aede-4a4755569619", "value": "bcc4117de367eda2c8ddfe0062775efac0da4373", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782445571", "to_ids": true, "type": "sha256", "uuid": "999805db-4f91-4ee3-9397-9bc267747a58", "value": "4195efdeb8833f17e545d1e46bfcbfa634382a5efe5696cedc24043c9e116372", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782444254", "to_ids": true, "type": "ssdeep", "uuid": "b1c753fc-d551-4575-b78b-c81a19a7a369", "value": "96:dMA+3RM39v//ojzhYXHJWD/Rz/dgTG/jR:dEBIKhY4D/Rz/iTG/9" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782444254", "to_ids": false, "type": "size-in-bytes", "uuid": "72786c3d-c8de-46c9-bca2-5b437fed242f", "value": "4522" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782444254", "to_ids": true, "type": "vhash", "uuid": "891933a6-b08e-4e9a-b7a5-93ecb47b316a", "value": "69217a65e49bf14f0e4f8ad4fa6177ed" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782444254", "to_ids": true, "type": "filename", "uuid": "cb050863-bb8a-47b5-b94e-07361fd1f647", "value": "eq9mjw6.exe" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 24/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782444255", "to_ids": false, "type": "text", "uuid": "5f789c78-f570-425a-8912-6b82c6b19bc0", "value": "Type Description: VBA\nMicrosoft: Trojan:Win32/Malgent\nVT Total Detection:28/60\nFirst Submission:2026-06-10T02:58:06.000000+00:00\nLast Submission:2026-06-10T02:58:06.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782446397", "uuid": "400b1830-3b7e-4c20-ac9b-b83c61b8879f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782446397", "to_ids": true, "type": "md5", "uuid": "46e60236-7ece-46b5-8e5f-94a2d2264834", "value": "20209b3a32769afc6a75694b8d8839dd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782445572", "to_ids": true, "type": "sha1", "uuid": "18502697-128f-48e6-b96d-d87227a7853c", "value": "89ccf86166fc132ab3e1c789aa443fd14e1cd529", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782445573", "to_ids": true, "type": "sha256", "uuid": "2875d475-924f-42d5-afa3-087a937f7094", "value": "cca9c3f98c6552a7b52132b4fb3d969db5c743b7e663e630d37ce8b2f619c30a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782444276", "to_ids": true, "type": "ssdeep", "uuid": "c3967f6a-5816-4e7c-bae3-d8071e41a1af", "value": "192:gH2wdY0/9zzWxyPkqjQh2F1cUwh8H2/v/no1/R71/S/QrK9VCM:gWwdnBzWxy2fUwhr2HrsJ" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782444276", "to_ids": false, "type": "size-in-bytes", "uuid": "d35faec1-f70c-48dc-8c11-45073056cb17", "value": "10142" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782444276", "to_ids": true, "type": "vhash", "uuid": "21f51e2c-78f6-407f-927c-7d271b3beb3f", "value": "f3ccba3deecb34e006416e3e04d75493" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782444276", "to_ids": true, "type": "filename", "uuid": "223a98ef-ff53-4bae-9592-7ea1e2f90ed6", "value": "Statement of Debt(A).vbs" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 24/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782444276", "to_ids": false, "type": "text", "uuid": "858832cb-f5b1-49ed-928c-69b83cc3151e", "value": "Type Description: VBA\nMicrosoft: Trojan:Script/Wacatac.B!ml\nVT Total Detection:28/60\nFirst Submission:2026-04-13T02:37:53.000000+00:00\nLast Submission:2026-06-12T13:46:53.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782446419", "uuid": "90b57dd9-4e5c-447b-8e94-f0a72b49c06d", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782446419", "to_ids": true, "type": "md5", "uuid": "94cf1c27-9651-46ed-924d-7dcfd8cc3d8b", "value": "2c6f05f1f309d89b2236e6c8b59c88f9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782445573", "to_ids": true, "type": "sha1", "uuid": "5c68180a-8f52-46e1-a5aa-4c5d7bbf893c", "value": "8b925dbebb1ae40af7f22cac52d8fdac2a255972", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782445574", "to_ids": true, "type": "sha256", "uuid": "57b0fa96-a91d-4fe0-a3a7-441eb7780281", "value": "f37d677ad936d6409e64a3ecc9f3685c455826db3dabbf21e8c54eb01ebd9128", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782444298", "to_ids": true, "type": "ssdeep", "uuid": "d6a4b246-740a-4029-812d-db192962d68b", "value": "768:+RjCpD9yjhuvG7G3twIqsD6jw4u2V2KamAbRybGu41Kw0oZTrKBLC:+R8yIz3tmsDgwp5m16NrZ36LC" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782444298", "to_ids": false, "type": "size-in-bytes", "uuid": "590e2354-d069-4879-a830-7a73d30d1554", "value": "41784" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782444298", "to_ids": true, "type": "vhash", "uuid": "93bf2790-5e69-426f-93ba-5b5806af3956", "value": "147886a3ea0a4962a3b746e2c978fa3d" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782444298", "to_ids": true, "type": "filename", "uuid": "c4b3d538-c193-44ed-9f8a-6ecf7e00fbaf", "value": "Account Statement\uff0813K\uff09 (2).vbs" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 24/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782444298", "to_ids": false, "type": "text", "uuid": "6b27d78e-f16b-4642-8c85-388dd049991e", "value": "Type Description: VBA\nMicrosoft: Trojan:Win32/Malgent\nVT Total Detection:25/61\nFirst Submission:2026-06-15T03:20:18.000000+00:00\nLast Submission:2026-06-15T03:41:27.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782446440", "uuid": "fa12422f-0642-43aa-9078-83c50ee8cb9a", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782446440", "to_ids": true, "type": "md5", "uuid": "e331ae9e-acf6-47ac-8fc9-c20dcf327631", "value": "3b1aba44dd3d9b6339b6f56e2f42034b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782445575", "to_ids": true, "type": "sha1", "uuid": "e049a0b4-de76-422c-b152-8fa1c6084c01", "value": "8be8f6955de47d980c257ab5bc732cfbd0e23d99", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782445575", "to_ids": true, "type": "sha256", "uuid": "fa37adf7-b755-459f-9270-d2207833b6fb", "value": "01f1eb07125db5de0c2362afc777aa015f136feabd769628f01d01ac6472646c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782444320", "to_ids": true, "type": "ssdeep", "uuid": "7aa3e8a4-08a0-493c-a8de-df376536bae4", "value": "192:IwUOi3mwQJp0fnH23HuOIxBRbZz5LoyC/N/vbX/6/zQ/XwXdB:IwUOi3/2CfnWXCt5LQb08wNB" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782444320", "to_ids": false, "type": "size-in-bytes", "uuid": "d4a53a31-3401-4f33-83a5-34e467638e09", "value": "12538" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782444320", "to_ids": true, "type": "vhash", "uuid": "eab1587a-f162-4322-93fc-de51912e8995", "value": "e5b58a5c16b3272f0575def6ee10083c" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782444320", "to_ids": true, "type": "filename", "uuid": "a05a88ce-4d8f-4081-8b34-8a0d6f3cb50b", "value": "Statement of Account.txt" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 24/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782444320", "to_ids": false, "type": "text", "uuid": "fa1badf8-41f1-4deb-b4af-e3607020496a", "value": "Type Description: VBA\nMicrosoft: TrojanDownloader:VBS/Periculant.A\nVT Total Detection:26/60\nFirst Submission:2026-02-26T09:58:21.000000+00:00\nLast Submission:2026-02-26T10:52:54.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782446461", "uuid": "5f903a47-3885-42da-8d93-758fd0be9182", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782446461", "to_ids": true, "type": "md5", "uuid": "5a4023a9-6dd2-42bd-9aba-ea7ebf522fc1", "value": "4044e4b6471c9de7b0a4ba37d9d9df9a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782445576", "to_ids": true, "type": "sha1", "uuid": "3fa7e0be-0051-47c2-87ed-12cadbf4cfa9", "value": "906d7fd1f8f75435b297cb7a72d0d4b64cd2c22b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782445576", "to_ids": true, "type": "sha256", "uuid": "c4216c65-e9c1-46ef-ad4d-a066cc405eac", "value": "6169aee26b75b486018e4fd10a2ec8d67de7d382c9f2900f2b8d78ea0c1cda33", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782444342", "to_ids": true, "type": "ssdeep", "uuid": "33679da3-42c2-4c12-9333-2b84f8497608", "value": "192:g0B2dY0/9zCz4XqjQh2FYewh8H2/s/nZy/z71/P/QrK9VCM:gA2dnlCzwuwhkGOrsJ" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782444342", "to_ids": false, "type": "size-in-bytes", "uuid": "c9e743a8-938b-4c61-b716-cd5177f65630", "value": "10144" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782444342", "to_ids": true, "type": "vhash", "uuid": "eeb1087e-012c-4250-87dd-c8e9f3fc1652", "value": "f3ccba3deecb34e006416e3e04d75493" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782444342", "to_ids": true, "type": "filename", "uuid": "be34cac2-e331-4623-a31d-2539559b441c", "value": "billing statement (2).vbs" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 24/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782444342", "to_ids": false, "type": "text", "uuid": "06a10b66-6802-4053-942f-e56469a71bba", "value": "Type Description: VBA\nMicrosoft: Trojan:Win32/Znyonm!rfn\nVT Total Detection:28/60\nFirst Submission:2026-04-17T09:23:35.000000+00:00\nLast Submission:2026-04-17T09:23:53.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782446482", "uuid": "b0f140fc-7b7f-466c-bfa5-96cea8f2318e", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782446482", "to_ids": true, "type": "md5", "uuid": "65fad9ff-f173-43f1-806b-4976d471d67a", "value": "4f0593e8e0e8fac49429e9b45ebf7fa1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782445578", "to_ids": true, "type": "sha1", "uuid": "030d1c0a-d044-4c8e-b5e8-92979440442f", "value": "ce43ada3da47c5b7a4e03af47e27612d54bf28c0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782445578", "to_ids": true, "type": "sha256", "uuid": "90d496f2-ad52-4493-b10d-0ed16df68190", "value": "1f92da4c68b8c88edf6e055ef75efd1dcf55296e252545f5782880f6556564d4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782444364", "to_ids": true, "type": "ssdeep", "uuid": "5a230c5e-a406-40e3-a412-243ba8d9c71b", "value": "96:YA+JvOn3vDKJTIBBSf4bGffTh7n632zMSuO6pT/8l+3WxR/4/01/VPAOI:YJaC2BZGzh7n63SMUW938/4/01/VP6" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782444364", "to_ids": false, "type": "size-in-bytes", "uuid": "093e4043-8d88-4873-a083-12e0c945cf3f", "value": "7094" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782444364", "to_ids": true, "type": "vhash", "uuid": "a261d423-c515-4449-91b7-7f7c74bf2718", "value": "3a399ff26a811036a2781440155438a0" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782444364", "to_ids": true, "type": "filename", "uuid": "59e2953e-559c-4945-9c44-57130cd3ee75", "value": "Outstanding Payment List.vbs" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 24/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782444364", "to_ids": false, "type": "text", "uuid": "25938c28-4674-485d-9f3e-d76ddeacf2f1", "value": "Type Description: VBA\nMicrosoft: Trojan:Win32/Leonem!rfn\nVT Total Detection:25/60\nFirst Submission:2026-06-08T03:26:17.000000+00:00\nLast Submission:2026-06-11T06:30:24.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782446503", "uuid": "18c919e0-cab7-4ddf-9943-b10eddff88cf", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782446503", "to_ids": true, "type": "md5", "uuid": "fbb7234e-0c2c-4790-aa7f-e51dfbfe92a4", "value": "5002eca748205d544618e3bd2dedc223", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782445579", "to_ids": true, "type": "sha1", "uuid": "208ee050-0145-46f2-8301-6886a7dcb6e7", "value": "ebe7b50d0a3c69bb5dce20e56dd84bd8940d1ace", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782445579", "to_ids": true, "type": "sha256", "uuid": "775cca93-a002-4683-84b1-5b00c6140ca3", "value": "f10dae1863e89f72adf8ba913b8a9fa898e6a430430098722e62600a2d4e94a4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782444385", "to_ids": true, "type": "ssdeep", "uuid": "d5f62468-e660-4b2c-a0bc-bed855b5a8e4", "value": "96:OA+Jvun3vDKJTIBBSf4bGffTh7n632zMSuO6pT/8l+wWxR/4/p1/VPArw:6JaC2BZGzh7n63SMUW9w8/4/p1/VPP" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782444385", "to_ids": false, "type": "size-in-bytes", "uuid": "f5c15233-b4ed-4a6f-9283-84f5826a4649", "value": "7107" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782444385", "to_ids": true, "type": "vhash", "uuid": "033addbe-511b-4681-971e-ab1c105893e2", "value": "9f78f829bb0a524c1be3e1952d7a60d0" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782444385", "to_ids": true, "type": "filename", "uuid": "8e1abceb-164d-4e7a-a214-5a11518424fa", "value": "Statement of Debt(29K).vbs" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 24/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782444385", "to_ids": false, "type": "text", "uuid": "ef943918-1e4a-486b-aca9-a1007bd75f5a", "value": "Type Description: VBA\nMicrosoft: Trojan:Win32/Ravartar!rfn\nVT Total Detection:22/60\nFirst Submission:2026-06-06T12:23:14.000000+00:00\nLast Submission:2026-06-06T12:23:14.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782446524", "uuid": "c06fc3af-8140-4732-a55a-f15dd8612e28", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782446524", "to_ids": true, "type": "md5", "uuid": "93418abb-a6cb-4cc1-a4eb-3a68d37f4f6d", "value": "5b6bbcc06cf08cc99e1afeda486d42fb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782445580", "to_ids": true, "type": "sha1", "uuid": "0ce05048-6928-4f74-839a-2d0ff48808e1", "value": "099a857acff8065b966c6c390c723f3cce0a7963", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782445581", "to_ids": true, "type": "sha256", "uuid": "7c86c9fe-8afc-4d78-b975-2623c5e003b5", "value": "b798fcbc54e84c03ac2b7be97d016d05f04cd754db36dd5c6cfbf3aedd0b7dff", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782444408", "to_ids": true, "type": "ssdeep", "uuid": "ee52632e-4bf0-47d2-ba25-a32fd9492577", "value": "96:BA+Jvqvn3vDKZvzVMcGCiGkT3632kMSuGr/U/+WxqlGAHJWD/Tz/dpWApw:FJyQvBzGCiGkT363lMUoVD/Tz/mZ" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782444408", "to_ids": false, "type": "size-in-bytes", "uuid": "c8509265-e98d-4bf4-8791-0ccd8584e7ff", "value": "6714" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782444408", "to_ids": true, "type": "vhash", "uuid": "85e38af2-b87f-4dd9-bb08-103e5fd46f47", "value": "d52feccfe890b691b36b680c18e48c75" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782444408", "to_ids": true, "type": "filename", "uuid": "6b4be4cb-f09c-4d89-8ab9-327de11cc094", "value": "Extrato de Concilia\u00e7\u00e3o.vbs" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 25/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782444408", "to_ids": false, "type": "text", "uuid": "da485583-461e-41d7-9cd5-7014f5787132", "value": "Type Description: VBA\nMicrosoft: Trojan:Script/Wacatac.B!ml\nVT Total Detection:18/61\nFirst Submission:2026-06-10T19:54:53.000000+00:00\nLast Submission:2026-06-10T21:18:12.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782446545", "uuid": "b193c1f0-52fa-474c-99ad-0ab07782ac80", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782446545", "to_ids": true, "type": "md5", "uuid": "ad13bf36-1452-49d9-8d0e-c8a0a4becc4b", "value": "6359e6236471cbe434d0ef4c42b7f879", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782445582", "to_ids": true, "type": "sha1", "uuid": "9ec8a568-ff0d-4b92-a3f8-8548a96df88e", "value": "4b9d81d5385ecf9a2ee7f31212d8812db149e836", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782445582", "to_ids": true, "type": "sha256", "uuid": "dde6128c-1aa1-422b-b05a-674c32ab2747", "value": "03402dbfc9ccfe612c37405bbcf072c9c07273fe4f77e82f8238a31d0040094d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782444430", "to_ids": true, "type": "ssdeep", "uuid": "069c81a6-f16c-4f0d-b793-1ea11027ad7a", "value": "96:1y9eAD9Ev29pPpHgKcYk7KR7PfL7HRLh/G/jy11/Dlzz:g91IQpoYk76nPR1/G/211/F" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782444430", "to_ids": false, "type": "size-in-bytes", "uuid": "55da174e-e1c6-4b12-915b-cdbf1d97dda3", "value": "5067" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782444430", "to_ids": true, "type": "vhash", "uuid": "a8f5cc66-2970-4d9c-bb97-938ba28a091b", "value": "febeaeca176212cc54ab420416064bc0" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782444430", "to_ids": true, "type": "filename", "uuid": "311b7b91-db53-4162-b198-cef36f1bb365", "value": "Applicationform1.vbs" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 24/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782444430", "to_ids": false, "type": "text", "uuid": "6edf87f7-698e-489d-a2f1-5d9137f38055", "value": "Type Description: VBA\nMicrosoft: TrojanDownloader:VBS/Obfuse.NWA!MTB\nVT Total Detection:28/60\nFirst Submission:2026-03-31T15:44:25.000000+00:00\nLast Submission:2026-03-31T15:44:25.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782446568", "uuid": "9a1b2d91-57a9-4cd1-9c3b-0095436005ae", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782446568", "to_ids": true, "type": "md5", "uuid": "a043c789-bdc3-4097-95b2-00e90d105239", "value": "63ac85195b73753333316a889cf5880f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782445583", "to_ids": true, "type": "sha1", "uuid": "9f8c6af0-4f72-4f8c-9696-e67f97751977", "value": "714a77ffa0f1ba46b30d125c28ae5cf06a849b2c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782445584", "to_ids": true, "type": "sha256", "uuid": "49d95e11-6396-47f3-ba8d-aec017d4656f", "value": "cff48752738313b9cb36bb381bbd415ac7d2e8395387b972460b58983af68fb7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782444452", "to_ids": true, "type": "ssdeep", "uuid": "3ae1dd75-326a-4da6-894c-d02226d4a046", "value": "192:gWABd00/9v7JafoT/S/nZe/x1/K/xgQCKN6NMS:gzBdb97kfoWQINoh" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782444452", "to_ids": false, "type": "size-in-bytes", "uuid": "f9335437-92f0-4dac-bbeb-4d6fc432de63", "value": "7050" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782444452", "to_ids": true, "type": "vhash", "uuid": "a4b90f25-2057-4acc-b8ca-f10272541571", "value": "768048fb3d93544d904fb7cabc2a43a1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782444452", "to_ids": true, "type": "filename", "uuid": "bd38c7eb-8467-427c-b2b6-1f6476244233", "value": "Statement of Account(O).vbs" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 24/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782444452", "to_ids": false, "type": "text", "uuid": "ec15ba7b-162f-437f-94ce-94fc1b979040", "value": "Type Description: VBA\nMicrosoft: TrojanDownloader:VBS/Obfuse.NWA!MTB\nVT Total Detection:25/60\nFirst Submission:2026-05-19T05:16:46.000000+00:00\nLast Submission:2026-05-19T05:16:46.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782446589", "uuid": "971b0045-ce98-4ebb-b2d7-1f21819eb899", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782446589", "to_ids": true, "type": "md5", "uuid": "b3dc9a59-1c16-4d05-955b-16470205fd63", "value": "66442f2457eca8f47385b1fb2c6fcab8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782445585", "to_ids": true, "type": "sha1", "uuid": "a57ffec0-0a13-4b73-894a-8533782ad450", "value": "91da365db0c863d345f63dde71a876c94e40e944", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782445585", "to_ids": true, "type": "sha256", "uuid": "d3e68bf5-e2c0-40fa-855f-8ff2a2396019", "value": "65662fbfee31784502f46a4ea3cf58a5146d6f6299b40391cd71c9fc67e3e621", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782444473", "to_ids": true, "type": "ssdeep", "uuid": "7cf4a6a9-ccde-45bd-b012-2947688e009a", "value": "96:TA+JvMn3vDKqTIBBSf4bGffTh7n632zMSuO6pT/8l+wWxR/4/p1/VPA2fw:bJMP2BZGzh7n63SMUW9w8/4/p1/VPW" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782444473", "to_ids": false, "type": "size-in-bytes", "uuid": "ea52b3ec-4546-493a-ab05-58494da406f6", "value": "7107" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782444473", "to_ids": true, "type": "vhash", "uuid": "4fdae46a-ff76-4061-9c13-da552afee396", "value": "9f78f829bb0a524c1be3e1952d7a60d0" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782444473", "to_ids": true, "type": "filename", "uuid": "b4652f15-ad05-4c9e-b283-5069350c7cc4", "value": "Statement of Debt(30K).vbs" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 25/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782444473", "to_ids": false, "type": "text", "uuid": "53a555bd-12f2-4b48-b3f0-8fede42d6e8c", "value": "Type Description: VBA\nMicrosoft: Trojan:Script/Wacatac.B!ml\nVT Total Detection:27/61\nFirst Submission:2026-06-06T09:31:40.000000+00:00\nLast Submission:2026-06-06T09:31:40.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782446610", "uuid": "85dbb866-6f9a-49fc-9f5c-bfb819221b6d", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782446610", "to_ids": true, "type": "md5", "uuid": "20e9d732-b422-48d5-9aa2-2cc418a9da6a", "value": "66705384a7ad81d14c34fc6c054a0ecf", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782445586", "to_ids": true, "type": "sha1", "uuid": "af4204d9-8bde-4a79-915c-b529c6a12df4", "value": "94ab393dc509a5529b5e6ff320a9543e7ae313ab", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782445587", "to_ids": true, "type": "sha256", "uuid": "1a087d54-a182-4971-a10d-5a40f10c84c2", "value": "5adf130842c88d6b732def0f5fd1be2a889a3f7dfbc5af5ff7438374f3ded233", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782444495", "to_ids": true, "type": "ssdeep", "uuid": "fc8549de-b173-479f-a506-93f2ce015db4", "value": "192:gzIWde0/9FobeODb2A5wLQDYF7rOWm6Uz/qVauF/f/7A/egUwbO4PgQCA:gUWdF3objb2A5wMz/SaMJ3wb/1/" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782444495", "to_ids": false, "type": "size-in-bytes", "uuid": "b4eb107c-cecd-428c-856e-659fbad6d4cc", "value": "10396" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782444495", "to_ids": true, "type": "vhash", "uuid": "171133cb-8638-43ca-8c29-fbae9437ecbb", "value": "6d7336ca704aece4463fb1e1a3b0046e" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782444495", "to_ids": true, "type": "filename", "uuid": "5470adea-9b13-44d6-8ef8-38d160f443aa", "value": "iowepv.vbs" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 25/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782444495", "to_ids": false, "type": "text", "uuid": "2bf42370-f426-494d-9926-cfa4558a0a8c", "value": "Type Description: VBA\nMicrosoft: Trojan:Win32/Malgent\nVT Total Detection:29/61\nFirst Submission:2026-05-29T18:21:25.000000+00:00\nLast Submission:2026-05-29T18:21:25.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782446631", "uuid": "16adc538-24b3-4219-9d52-5c32dfa9ca62", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782446631", "to_ids": true, "type": "md5", "uuid": "4004ba0b-2a8e-4f33-a056-fc8c0f95776e", "value": "68c16c46f8afb9e00bbaba0207fb0a46", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782445588", "to_ids": true, "type": "sha1", "uuid": "c3e89def-7db6-4295-9374-667dce002b28", "value": "c5e9769460981ca109f2a61e89662288ff907b5d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782445588", "to_ids": true, "type": "sha256", "uuid": "2e0e0335-2812-46b3-a2a1-cba59414c317", "value": "09cfe9dbd75095b17ccea62466ff128279e54a0d501587ec9c5b992b987b5784", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782444517", "to_ids": true, "type": "ssdeep", "uuid": "e0d16400-7ef4-4ae0-a158-7f6846fcdc02", "value": "192:gymrdY0/9rWaLIqjQh2FYbwh8H2/s/nZy/z71/P/QrK9VCM:gFrdntWauLwhkGOrsJ" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782444517", "to_ids": false, "type": "size-in-bytes", "uuid": "40425fd9-f974-4479-89fe-136ba98ab5eb", "value": "10145" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782444517", "to_ids": true, "type": "vhash", "uuid": "af155efd-3c64-4693-9fcc-63314d3c4e9f", "value": "f3ccba3deecb34e006416e3e04d75493" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782444517", "to_ids": true, "type": "filename", "uuid": "7fba41f6-91e3-4540-8543-7b54d1e0f740", "value": "Debt Note (2).vbs" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 24/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782444517", "to_ids": false, "type": "text", "uuid": "163d9fd3-57c8-453d-85d1-633d027bf524", "value": "Type Description: VBA\nMicrosoft: Trojan:Win32/Malgent\nVT Total Detection:28/60\nFirst Submission:2026-04-16T02:39:12.000000+00:00\nLast Submission:2026-04-16T02:39:12.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782446652", "uuid": "89f4c4eb-209d-410b-9e1d-e9ea113e5cdc", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782446652", "to_ids": true, "type": "md5", "uuid": "6f21d0a3-1917-480e-b719-0e1406bac7c4", "value": "6c39900d77dcba158e1d27c7619cb06d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782445589", "to_ids": true, "type": "sha1", "uuid": "f1c6af4e-bd16-4537-98af-faa8d4cf5c11", "value": "a3b83e946c38e607de4ad774737af86f312a6b98", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782445589", "to_ids": true, "type": "sha256", "uuid": "94cee129-1ef0-46ea-9f59-077fe1c16cd0", "value": "a95ee5a8c40c7705f1612335f3e4f4fcd8a28692095c04e0d48f7a6e77caa42b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782444539", "to_ids": true, "type": "ssdeep", "uuid": "8c1a3da4-f342-40ec-b1d6-fae82bd1cf03", "value": "384:R9IRY5wT/icu60TwB71EIRj9Ep8WbLDI1HEuY4OB99sJcUyzFoHZCbywmLse0lsf:UY5wDibJTwBba7LM1HR8riYCHZCbI0ef" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782444539", "to_ids": false, "type": "size-in-bytes", "uuid": "7930928c-5221-4a3f-b3cc-41445ba9ed96", "value": "27253" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782444539", "to_ids": true, "type": "vhash", "uuid": "b7fcd66a-bcce-4680-8873-b6142501ce5f", "value": "d293a617c624f7939854321e963d897a" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782444539", "to_ids": true, "type": "filename", "uuid": "90a178ce-b0b1-488a-867c-2c077a17be5c", "value": "Outstanding Balance Sheet(A).vbs" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 24/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782444539", "to_ids": false, "type": "text", "uuid": "b356c2a5-af8d-49de-b1a3-d03846801689", "value": "Type Description: VBA\nMicrosoft: Trojan:Win32/Malgent\nVT Total Detection:29/60\nFirst Submission:2026-06-12T02:23:58.000000+00:00\nLast Submission:2026-06-12T02:23:58.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782446674", "uuid": "ee033ee5-7972-4957-8dc6-8f8542e40870", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782446674", "to_ids": true, "type": "md5", "uuid": "c7e6a1ac-1a02-4844-b283-c927f0d6daa9", "value": "6fb6a55424adfb61e31f06aef33273e5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782445591", "to_ids": true, "type": "sha1", "uuid": "f36029a9-886f-4ae6-b4fb-d82968d8b9c8", "value": "544947ad03056b25b68f1cbfd8ff9c8689e67e28", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782445591", "to_ids": true, "type": "sha256", "uuid": "c176211f-dca9-4477-8fa5-713874d6b52e", "value": "1c5e88505728e1b11507fe7d6672eb89de200bd45c79030fe60edae2a17b69cf", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782444561", "to_ids": true, "type": "ssdeep", "uuid": "6db38f4a-7573-4886-9a55-58bc836e3559", "value": "96:YAr5a9llfo9jO9dtn0qDxYXOZ7bFwnSoWzfk4zlK/2F7:FsZT9UQtb2PWz9Q/2B" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782444561", "to_ids": false, "type": "size-in-bytes", "uuid": "3ebde862-d87a-41cd-9612-a1d18b8cd307", "value": "5337" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782444561", "to_ids": true, "type": "vhash", "uuid": "85a4b074-a448-43e8-a708-92c746f097f1", "value": "6edd7a671bf8eb77941ead83a6eaeb37" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782444561", "to_ids": true, "type": "filename", "uuid": "c33cdd72-db69-4d99-af44-76038cd29d82", "value": "dfjieya.vbs" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 24/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782444561", "to_ids": false, "type": "text", "uuid": "77df518d-6e14-4478-bfbe-0f1e0f443c1e", "value": "Type Description: VBA\nMicrosoft: Trojan:VBS/Obfuse.KRW!MTB\nVT Total Detection:29/61\nFirst Submission:2026-05-19T09:06:47.000000+00:00\nLast Submission:2026-05-19T09:06:47.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782446695", "uuid": "cb592c0c-beb3-42a4-8c1b-10a9846065e9", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782446695", "to_ids": true, "type": "md5", "uuid": "cf97bc69-459d-4760-b824-f7aa2ea6bfeb", "value": "7403cbcc5a9c32384d431856dc48fcc9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782445591", "to_ids": true, "type": "sha1", "uuid": "063ee378-e0a8-4c65-be5d-3f5d6bef1460", "value": "e9b0b10ec99380f1db343c1578375268a9a8d5ae", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782445592", "to_ids": true, "type": "sha256", "uuid": "c7d402a4-1447-43cf-a5d6-a596a0fec7a3", "value": "a34b77d553f35517efbe27d1afb966fa4e8819adf5decee8b7e496c84aea4260", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782444582", "to_ids": true, "type": "ssdeep", "uuid": "beb4e7fa-c33f-4b8d-8839-0da8587ffcda", "value": "192:gGyFdY0/9WQeHMqjQh2FYjwh8H2/s/nZy/z71/P/QrK8AzCM:g9FdnMQe2zwhkGOrcJ" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782444582", "to_ids": false, "type": "size-in-bytes", "uuid": "6c139bfa-9a2a-4c47-b6a7-522a669d2220", "value": "10184" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782444582", "to_ids": true, "type": "vhash", "uuid": "7c17aa27-d0b6-415e-b4cd-1ad38cf96b8c", "value": "f3ccba3deecb34e006416e3e04d75493" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782444582", "to_ids": true, "type": "filename", "uuid": "37082779-f149-4d30-a235-37524489aee1", "value": "Statement of debt (4).vbs" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 24/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782444582", "to_ids": false, "type": "text", "uuid": "39edf26d-8cc1-4158-839e-46450d83eb9a", "value": "Type Description: VBA\nMicrosoft: Trojan:Script/Wacatac.B!ml\nVT Total Detection:28/60\nFirst Submission:2026-04-15T03:46:08.000000+00:00\nLast Submission:2026-04-15T04:17:59.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782446716", "uuid": "582adb99-816b-42a6-beac-3cc83bc3fcc2", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782446716", "to_ids": true, "type": "md5", "uuid": "facbe2de-7a9a-4787-9393-806b314bb5ca", "value": "74fd9f91fc93b6288b4fc253ea5b3e20", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782445593", "to_ids": true, "type": "sha1", "uuid": "95d7752d-f0d6-4a42-90cc-be505a999568", "value": "1dfee3e206814902489afc80b8eb8b428a286e3c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782445593", "to_ids": true, "type": "sha256", "uuid": "b5ce2ee0-c51a-4923-8c78-771444011fd2", "value": "ae44ee4b40c478c109e795c328812d9ebb82750233cf18d0dd3ac1d4518a08c6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782444604", "to_ids": true, "type": "ssdeep", "uuid": "69a89908-7bb0-41bc-8685-c33849bf8595", "value": "192:g1sFda0/9t+JC1oT/S/nZe/x1/K/xgQCjNF:gOFdJH+E1oWQIAn" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782444604", "to_ids": false, "type": "size-in-bytes", "uuid": "b13c40a0-a7e7-495f-96a2-01d133cbf6ce", "value": "7062" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782444604", "to_ids": true, "type": "vhash", "uuid": "4a409b94-4752-4179-afdf-71d92868add2", "value": "768048fb3d93544d904fb7cabc2a43a1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782444604", "to_ids": true, "type": "filename", "uuid": "6c294656-de1c-4c2c-9b47-5b1f5f697e42", "value": "Sila semak bil anda..vbs" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 24/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782444604", "to_ids": false, "type": "text", "uuid": "c46d1fab-a107-40cc-85bf-7740fa19f146", "value": "Type Description: VBA\nMicrosoft: TrojanDownloader:VBS/Obfuse.NWA!MTB\nVT Total Detection:28/60\nFirst Submission:2026-05-20T02:26:28.000000+00:00\nLast Submission:2026-05-25T07:00:37.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782446738", "uuid": "c29f94f3-b1fb-4014-9728-c704454642a8", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782446738", "to_ids": true, "type": "md5", "uuid": "9fc7d582-4acd-4b66-bd80-e80a63d83630", "value": "7849061c536a3efb05a56d504694e7e7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782445594", "to_ids": true, "type": "sha1", "uuid": "2c182e54-8b2d-493b-9558-a7fe59bc1ce7", "value": "d992f9610f29fcbba32b10c290076ea4fbe405a4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782445594", "to_ids": true, "type": "sha256", "uuid": "8e0eaa66-e001-4545-b1a2-1d7e4f53851d", "value": "c30408b75ebc58d15f2766db15e3789dbf2909b0d71c99a13499e25270c275ee", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782444626", "to_ids": true, "type": "ssdeep", "uuid": "b151615d-91a6-4368-9abb-1e1e45145805", "value": "768:BuJD2OzPnSxn4S0zNyJapZ77X+ENarMXVxNzHsO0VpbLFMCaYbOQ:BmjYn4Pz+appXvNNHMaCaqOQ" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782444626", "to_ids": false, "type": "size-in-bytes", "uuid": "d7ac11fd-6404-4f0c-b98d-3b2d638202da", "value": "38365" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782444626", "to_ids": true, "type": "vhash", "uuid": "2241ece0-8592-4152-904d-2a5a93977317", "value": "8a4fbd0410a263cfccdfa19c4de575c5" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782444626", "to_ids": true, "type": "filename", "uuid": "3a3f5d40-1268-47ab-8d91-367e3598ac72", "value": "6oy.vbs" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 24/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782444626", "to_ids": false, "type": "text", "uuid": "d01a3a7b-b3d9-4524-91bc-eb7631e4cc4e", "value": "Type Description: VBA\nMicrosoft: Trojan:Win32/Ravartar!rfn\nVT Total Detection:28/60\nFirst Submission:2026-06-15T06:28:19.000000+00:00\nLast Submission:2026-06-15T06:28:19.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782446759", "uuid": "dc6fba0e-6dfa-4ea3-b5da-9f66654e3f0b", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782446759", "to_ids": true, "type": "md5", "uuid": "f09160d3-7c86-4589-b275-e19a39b6762c", "value": "79ecd61b09b0f2d54b34586c916c4ec9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782445596", "to_ids": true, "type": "sha1", "uuid": "771c7387-76ee-45b2-8027-2df64efe803d", "value": "59e962bc250c3c6d0be6f2ac6e9d2ebbb00c5548", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782445596", "to_ids": true, "type": "sha256", "uuid": "28828dcc-e242-4eea-a927-776ec583d80c", "value": "be532be5beac3c7656654628cc557e546aea3ee47c0046428a53d23ac58875d1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782444648", "to_ids": true, "type": "ssdeep", "uuid": "1f9ee8b0-290d-47db-9429-dcb235f3058f", "value": "48:LKv0AgeLw4PuqZ/dfx7HBJQr4/NasUulS+i4Jn/a5r4WM:LPAiOuqZ/dfZhJy4/UsUu0+is/srC" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782444648", "to_ids": false, "type": "size-in-bytes", "uuid": "feca8e2d-07b7-42a6-90c0-9cda5d299a3c", "value": "2883" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782444648", "to_ids": true, "type": "vhash", "uuid": "d5f0ceba-ecc4-4ca9-b2b9-51315297f3a3", "value": "3f0b30fcae220f134aafcf7ab429f4b0" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782444648", "to_ids": true, "type": "filename", "uuid": "843c0b6e-54cf-4677-a4ca-31dc880b8995", "value": "sac8.vbs" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 24/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782444648", "to_ids": false, "type": "text", "uuid": "781cb549-a994-4973-8e0f-64db8563774f", "value": "Type Description: VBA\nMicrosoft: Trojan:Win32/Ravartar!rfn\nVT Total Detection:30/60\nFirst Submission:2026-03-31T18:03:35.000000+00:00\nLast Submission:2026-03-31T18:03:35.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782446781", "uuid": "12e00823-bf8f-487d-b370-f90952a85769", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782446781", "to_ids": true, "type": "md5", "uuid": "f674f3a1-b7e6-4fbd-9413-f5e8b186d68c", "value": "7f16449cd0c4862d1eadf8a5742bf09a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782445597", "to_ids": true, "type": "sha1", "uuid": "9e0a967b-56b8-42c2-b524-478da7e3bd3f", "value": "6c287b676b39f4c244ad568383ff7984011997e5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782445597", "to_ids": true, "type": "sha256", "uuid": "2503a51c-51b1-4ab8-9e7d-38dba59d9d6b", "value": "76d351946565aed51b1cb8361097ca5e7d9a6d281300a188cfa8aff9b6845234", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782444670", "to_ids": true, "type": "ssdeep", "uuid": "5dee6656-985c-4d54-abe5-20c0206b81c2", "value": "48:LK2xAgX2LN4PuFH2lPMfSTBJZr4/aoasUulo+I+4Dsn/Br+W8kQ:LvALOuFH2lEfIJZ4/aTsUuK+I+Ec/Brq" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782444670", "to_ids": false, "type": "size-in-bytes", "uuid": "c23bdfef-6626-4474-b7a2-d8c04c0bdbf0", "value": "2863" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782444670", "to_ids": true, "type": "vhash", "uuid": "7f12e6e0-3e33-4dd7-ac89-6c23d0478a69", "value": "3f0b30fcae220f134aafcf7ab429f4b0" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782444671", "to_ids": true, "type": "filename", "uuid": "45e40647-0d18-4be6-aa39-36726ec8a54b", "value": "payload_1.vbs" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 24/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782444671", "to_ids": false, "type": "text", "uuid": "3d81dc45-ffc9-41e9-83dc-d7edd8c7c520", "value": "Type Description: VBA\nMicrosoft: Trojan:Script/Wacatac.B!ml\nVT Total Detection:25/60\nFirst Submission:2026-04-02T15:21:39.000000+00:00\nLast Submission:2026-04-02T15:21:39.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782446802", "uuid": "b318e916-a718-4f72-aecc-503fab414744", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782446802", "to_ids": true, "type": "md5", "uuid": "89ca7570-37d1-49c1-b144-e8a8bb6e9a9d", "value": "7f81c1bc8cfd588e8998968e2621456e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782445599", "to_ids": true, "type": "sha1", "uuid": "8abea847-f9e8-439b-9b39-e2d05f2c5e4d", "value": "dabc92cbf18b7f9511b71e91918abcea7dc22e8b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782445599", "to_ids": true, "type": "sha256", "uuid": "1e766f2d-2ed3-419a-b859-6606996c91db", "value": "30ded95156d23ea8911d76b07ac0e4dfc90d9f2ed94545775f355f118a2beb13", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782444693", "to_ids": true, "type": "ssdeep", "uuid": "0938b95d-6aaa-4ee7-aa55-fe298c5d9385", "value": "96:SA+JvAn3vDKJTIBBSf4bGffTh7n632zMSuO6pT/8l+KWxR/4/01/VPALO:GJIC2BZGzh7n63SMUW9K8/4/01/VPZ" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782444693", "to_ids": false, "type": "size-in-bytes", "uuid": "acdc599f-84d5-414d-9613-9565015a94e1", "value": "7193" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782444693", "to_ids": true, "type": "vhash", "uuid": "6a0ea9ed-a5d7-4600-abff-05d1f62677f9", "value": "3a399ff26a811036a2781440155438a0" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782444693", "to_ids": true, "type": "filename", "uuid": "f8721bbb-f87a-4856-9022-2ec803520a97", "value": "Outstanding Payment List.vbs" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 24/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782444693", "to_ids": false, "type": "text", "uuid": "38a2b3be-184b-424f-a04e-6e2820fa90d2", "value": "Type Description: VBA\nMicrosoft: Trojan:Script/Wacatac.B!ml\nVT Total Detection:24/60\nFirst Submission:2026-06-08T07:55:41.000000+00:00\nLast Submission:2026-06-08T07:55:41.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782446823", "uuid": "0da62c1a-128f-4591-84df-82ad08545533", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782446823", "to_ids": true, "type": "md5", "uuid": "be5cfcad-a755-42f7-992d-62fc59e7dbf6", "value": "8c3322009b8982663c0cbecd9492e7eb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782445600", "to_ids": true, "type": "sha1", "uuid": "fabd91a1-2121-42d5-872a-4bf27f3523c6", "value": "9dd2143d6df8271db484a40e9c31e88a6cfa68bf", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782445600", "to_ids": true, "type": "sha256", "uuid": "86db0450-1dc0-4c74-abac-5091552f8bc9", "value": "3c9cc5b72fdd0a52fcecae8c5b952933163527599a15189a01ded39a1a8609e4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782444715", "to_ids": true, "type": "ssdeep", "uuid": "3940da40-ee68-4c04-949a-98c4a1903248", "value": "96:1yLYA1480LZsG29pPd0SvnAgwa3d60WaM5KrO/B/73QazC8:gLFcLQ22lU0XuF/B/7gQC8" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782444715", "to_ids": false, "type": "size-in-bytes", "uuid": "8b3345f5-7f88-4eb4-b302-717512394b23", "value": "5332" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782444715", "to_ids": true, "type": "vhash", "uuid": "ae86b59e-c073-434b-b34f-ddbf87784799", "value": "96f6bd642eeaab2dff140d7a213ee78f" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782444715", "to_ids": true, "type": "filename", "uuid": "4c55da10-6a87-4a0a-bbaa-38e545895359", "value": "0lf.vbs" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 24/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782444715", "to_ids": false, "type": "text", "uuid": "76ad99b2-b016-40f6-b96d-ec5a33ce4ed8", "value": "Type Description: VBA\nMicrosoft: Trojan:Script/Wacatac.B!ml\nVT Total Detection:27/60\nFirst Submission:2026-04-07T11:43:26.000000+00:00\nLast Submission:2026-04-07T11:43:26.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782446844", "uuid": "8793eb40-5d8b-4764-adcb-d5e53c21155c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782446844", "to_ids": true, "type": "md5", "uuid": "cd4ce47f-26cd-47d0-871a-161567199de6", "value": "8c6d9fc389ad3f20ccbc71d77eb39bfa", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782445602", "to_ids": true, "type": "sha1", "uuid": "2e87f255-e3ef-4a7d-9b1f-349aaf4c2d9a", "value": "e39c2f0ecc8420551dc01759cc1aa638367561bf", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782445602", "to_ids": true, "type": "sha256", "uuid": "205a5493-9eec-48fd-8c6e-8d0f6d07844e", "value": "27b5cea842c0add3cb0d7a106ee190eda65201e45cfcfd20f340fd26d1290118", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782444737", "to_ids": true, "type": "ssdeep", "uuid": "b126b240-5fe7-4f34-956e-e73672a81284", "value": "96:1yi/A+2z0GDHAemfffS9xOsW502qJxRDiSurfEf+hrzaDBybDMTI8xB+hgnqEsYN:gi/8dA3XqlJ/i2LMDYF7XOpSL/Gu/MUT" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782444737", "to_ids": false, "type": "size-in-bytes", "uuid": "807725ff-a419-40c3-8eb6-36432239bcd5", "value": "9450" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782444737", "to_ids": true, "type": "vhash", "uuid": "261be07c-409d-4958-83bb-1ab7012cbc77", "value": "2712d09a7bc853c7ad222cdbc6565e10" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782444737", "to_ids": true, "type": "filename", "uuid": "7b1b1da9-f4c5-46d5-b2ee-48f9a7235896", "value": "btksfmsi.vbs" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 24/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782444737", "to_ids": false, "type": "text", "uuid": "568c9dee-70d5-4c72-8e7a-86a29ab709c8", "value": "Type Description: VBA\nMicrosoft: Trojan:Win32/Pomal!rfn\nVT Total Detection:29/60\nFirst Submission:2026-05-19T06:28:30.000000+00:00\nLast Submission:2026-05-19T06:28:30.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782446865", "uuid": "bcb47c5d-46c5-4390-b6e0-9b4dbc8c947d", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782446865", "to_ids": true, "type": "md5", "uuid": "672889cf-19cc-42c4-ba5e-290125de9769", "value": "993f4c0cadbc769a4b0ed62a918db58d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782445603", "to_ids": true, "type": "sha1", "uuid": "51611ad0-343d-4dd8-b51d-a6ed46805a7d", "value": "ca3b7f7b30021cd2858b2881137a809e8079d975", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782445603", "to_ids": true, "type": "sha256", "uuid": "1e2af078-1ca8-4f5c-9255-89ed9e72cdd9", "value": "69efbea795491bdac117a299f18977f1e2968a06e7cd3a11f6366169d7214b04", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782444759", "to_ids": true, "type": "ssdeep", "uuid": "d620de41-9d65-42cd-9ace-5f0fe41ab432", "value": "96:FA+Jv0n3vDKJTIBBSf4bGffTh7n632zMSuO6pT/8l6vyWxR/4/T1/jPAYq:BJ0C2BZGzh7n63SMUWR68/4/T1/jP6" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782444759", "to_ids": false, "type": "size-in-bytes", "uuid": "43860fc5-3935-4233-936b-2d1f4057b512", "value": "7149" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782444759", "to_ids": true, "type": "vhash", "uuid": "0d742228-0b38-4b8d-a8b5-ba52e44e0c27", "value": "3a399ff26a811036a2781440155438a0" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782444759", "to_ids": true, "type": "filename", "uuid": "78b6ea3e-ce65-4bb2-b5ae-a15c895455be", "value": "FinancialReportsS.vbs" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 24/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782444759", "to_ids": false, "type": "text", "uuid": "0298f5ae-e554-4648-9ee9-4a43ea5391fe", "value": "Type Description: VBA\nMicrosoft: Trojan:Win32/Malgent\nVT Total Detection:26/60\nFirst Submission:2026-06-09T03:28:17.000000+00:00\nLast Submission:2026-06-12T14:00:19.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782446887", "uuid": "1c60fa0b-074f-4d40-82e4-535a3a7b9c22", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782446887", "to_ids": true, "type": "md5", "uuid": "84f5c5ac-3451-4db8-9e89-8f00e53f5cff", "value": "9d9ac85765e4a818a3ccabe2cf4fef82", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782445605", "to_ids": true, "type": "sha1", "uuid": "d74c1b9e-29c2-4a7e-a9f9-bf709d951ab0", "value": "554e768fb5c750754c0871bd1228d819ba367889", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782445605", "to_ids": true, "type": "sha256", "uuid": "40a16afd-5ee2-4551-a8dd-63a91ff0aa6f", "value": "3a18072502c440c51cf8bf42f21fa6fa3216788982892868380c04818fb61291", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782444780", "to_ids": true, "type": "ssdeep", "uuid": "c756df30-3672-4051-80c0-8548c407d5b4", "value": "192:g9ZPhd70/9LKaShoT/S/nZe/x1/K/xgQCxNhNx:g9lhdCJRShoWQIi/7" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782444780", "to_ids": false, "type": "size-in-bytes", "uuid": "1a6fc6ba-ee09-4a57-8f3b-288d8d7c727e", "value": "7042" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782444780", "to_ids": true, "type": "vhash", "uuid": "00003c2e-5c34-454f-8688-f5110078da53", "value": "768048fb3d93544d904fb7cabc2a43a1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782444780", "to_ids": true, "type": "filename", "uuid": "5525a183-02c6-45de-bdd7-0578ce0d1944", "value": "3a18072502c440c51cf8bf42f21fa6fa3216788982892868380c04818fb61291.vbs" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 24/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782444780", "to_ids": false, "type": "text", "uuid": "f7eb08f2-b762-4764-aa27-037c5793cf2a", "value": "Type Description: VBA\nMicrosoft: TrojanDownloader:VBS/Obfuse.NWA!MTB\nVT Total Detection:28/60\nFirst Submission:2026-05-18T20:36:47.000000+00:00\nLast Submission:2026-05-19T17:29:32.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782446908", "uuid": "9c044a54-8378-410e-9d33-ac34ff583763", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782446908", "to_ids": true, "type": "md5", "uuid": "df9bd93c-e0fc-4970-9408-ee46afd705dd", "value": "9f13c7b8ba391b2f597874e54d310648", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782445605", "to_ids": true, "type": "sha1", "uuid": "25fbca87-1850-47a9-8127-e630448bb273", "value": "6df13658b646620dcb698ce7468b71e538cfcb48", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782445606", "to_ids": true, "type": "sha256", "uuid": "137c7502-5b22-485d-bb7a-86cb7f8753ce", "value": "586607815075bafbe7a868c658e0a5a43e959ebace304ddf3925fa8a6b2d5b6c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782444803", "to_ids": true, "type": "ssdeep", "uuid": "5aa208a0-3326-46c8-94e6-f3ba5c89538f", "value": "96:MA+Jvin3vDKZvzVMcGCiGkT3632kMSuGr/U/+Wxq45whHJWD/Tz/dp+O:EJmQvBzGCiGkT363lMUolD/Tz/P" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782444803", "to_ids": false, "type": "size-in-bytes", "uuid": "8e5a4199-7823-4d39-82a5-11025ba0e763", "value": "6209" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782444803", "to_ids": true, "type": "vhash", "uuid": "3cfb62f2-bc73-4b42-9724-3d21c5e18859", "value": "d52feccfe890b691b36b680c18e48c75" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782444803", "to_ids": true, "type": "filename", "uuid": "71a15c09-6f92-48ce-93b4-4464f6848a15", "value": "Electronic statement(A).vbs" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 25/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782444803", "to_ids": false, "type": "text", "uuid": "ee7a08c0-42e6-4d48-9ab5-ec64adaed2c8", "value": "Type Description: VBA\nMicrosoft: Trojan:Script/Wacatac.B!ml\nVT Total Detection:19/60\nFirst Submission:2026-06-11T08:49:05.000000+00:00\nLast Submission:2026-06-11T08:49:05.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782446929", "uuid": "3af6c104-f416-4d1f-b38d-ed40c034f438", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782446929", "to_ids": true, "type": "md5", "uuid": "bb46a0fc-029b-4e5f-a542-2d53cdb43a5d", "value": "b7cd06c71465038b658a6dc1f273a507", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782445607", "to_ids": true, "type": "sha1", "uuid": "d91f4379-a624-4e73-a846-27087ef58545", "value": "8feed8e6e580f850bdc2735cc74a6b11533ed927", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782445607", "to_ids": true, "type": "sha256", "uuid": "0585a710-e401-4420-9975-ad858bfb4eb7", "value": "4e2c296a386b54b3e8360d899afb10da87de403687754bba200fbf3afbb634ea", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782444825", "to_ids": true, "type": "ssdeep", "uuid": "c5224f94-43f6-46cc-a4d1-4a1a68b565ba", "value": "96:r9aA4gjx6d6bWr1Py7MZsNIKaEea/ahBrB/ATOvBcPA/ke3QazC8:+Ube1CjNIDa/K1/A6vBcY/kegQC8" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782444825", "to_ids": false, "type": "size-in-bytes", "uuid": "92e89f13-aec1-4ad1-82a0-5443256f3f80", "value": "6173" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782444825", "to_ids": true, "type": "vhash", "uuid": "dd8c8cf3-f396-4d36-99f6-beede1103eb0", "value": "9be56738bc93b48b34d4a412eeca7975" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782444825", "to_ids": true, "type": "filename", "uuid": "622a6ee8-c06d-46d2-b5cf-d57c978691f3", "value": "zlz49.exe" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 24/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782444825", "to_ids": false, "type": "text", "uuid": "1a41cad9-6e62-40b7-b7aa-1a0610a1df78", "value": "Type Description: VBA\nMicrosoft: Trojan:Win32/Malgent\nVT Total Detection:28/60\nFirst Submission:2026-06-11T08:19:57.000000+00:00\nLast Submission:2026-06-15T06:12:56.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782446950", "uuid": "80f4d3cd-154a-4691-8407-f769a245c83e", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782446950", "to_ids": true, "type": "md5", "uuid": "5668a2a7-b5e3-454c-bc66-1cff25a24022", "value": "c7f38cbb99c8b74fa0465293feeba700", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782445608", "to_ids": true, "type": "sha1", "uuid": "b3f6bfde-77cd-409a-8f33-79645d86c152", "value": "282d534982002a43d2e8c18a2f589b40628829cf", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782445608", "to_ids": true, "type": "sha256", "uuid": "96d0156c-c4c8-433a-924c-7115ac168eb6", "value": "1bbb72557fcaa408bfe02ef68dc1c6c4ced901a461be3f3754b0d2f691eee032", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782444847", "to_ids": true, "type": "ssdeep", "uuid": "10466af6-c272-4d3f-b31b-d7296430d18f", "value": "192:zJKC2BZGzh7n63SMUW9LPiI8/4/01/VPA:z2BZu7qSCZiIwbA" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782444847", "to_ids": false, "type": "size-in-bytes", "uuid": "40e897d5-5fd9-42cb-98db-ae92cf92491c", "value": "7140" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782444847", "to_ids": true, "type": "vhash", "uuid": "6f24c5f6-aafb-4f6d-b015-79dbc2e52fd4", "value": "3a399ff26a811036a2781440155438a0" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782444847", "to_ids": true, "type": "filename", "uuid": "b23d4229-fa91-497a-8671-7e427bc4960e", "value": "Financial Reports.vbs" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 24/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782444847", "to_ids": false, "type": "text", "uuid": "9a4c2459-f78a-4863-a027-615736890066", "value": "Type Description: VBA\nMicrosoft: Trojan:Win32/Malgent\nVT Total Detection:26/60\nFirst Submission:2026-06-10T06:27:15.000000+00:00\nLast Submission:2026-06-10T06:27:15.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782446971", "uuid": "ab750996-ab0c-4860-9c8a-29c36918d612", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782446971", "to_ids": true, "type": "md5", "uuid": "92857d7a-96b6-4e84-bb06-6d7fb50f075f", "value": "d01cad98dd0d01b75e04e784953c5e2b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782445610", "to_ids": true, "type": "sha1", "uuid": "5f0a742b-1456-47a4-b223-8185b9a0eb4c", "value": "b32eecc0bd14d76d9121206960ad0988a56d150b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782445610", "to_ids": true, "type": "sha256", "uuid": "e75a34af-05db-4b4c-9f01-0616e091324a", "value": "4a1b69a8ab51378c1e36c5d9944c4a345e0502cb8cfe2ab7fd9a9496553b02c6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782444868", "to_ids": true, "type": "ssdeep", "uuid": "8ecd3cf5-da5e-4ff0-92af-761d5b5c3668", "value": "384:lKONEw3AqSRRqf6bLHTTCQ6rarGTyV3MID6bO4aDgyHdkI2WmimIAd5hyCsfQW5E:M2Ec07qsTC1+yTyH4mgMkI2imIA8K" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782444868", "to_ids": false, "type": "size-in-bytes", "uuid": "2399a1e4-4b5f-4e84-9cc6-404858966d5d", "value": "31554" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782444868", "to_ids": true, "type": "vhash", "uuid": "7aa74aa9-9e16-4576-9941-b3ad26846ff5", "value": "8a4fbd0410a263cfccdfa19c4de575c5" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782444868", "to_ids": true, "type": "filename", "uuid": "3886382a-9ace-44bc-bd7f-a52985aa8ecf", "value": "zip_bloy.vbs" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 24/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782444868", "to_ids": false, "type": "text", "uuid": "f76d4464-7297-4a06-ab19-52429088c57b", "value": "Type Description: VBA\nMicrosoft: Trojan:Script/Wacatac.B!ml\nVT Total Detection:27/60\nFirst Submission:2026-06-13T08:47:45.000000+00:00\nLast Submission:2026-06-13T08:47:45.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782446992", "uuid": "9ee7a649-c8a6-4055-9dc5-98c49c96b631", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782446992", "to_ids": true, "type": "md5", "uuid": "63ab564b-6343-47b0-9d38-433cde6fd925", "value": "d06333c360b51456f427e616c3c5f8bd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782445611", "to_ids": true, "type": "sha1", "uuid": "ccf3b5de-117e-45d1-93da-1f97ec5e3c5f", "value": "78a483a1b47f824c4d6b4e4165ccbebff242b0eb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782445611", "to_ids": true, "type": "sha256", "uuid": "d9c5d5ea-d199-4e15-a777-aaffaf6a24c0", "value": "99681a15717aedb8f3d2df119d313334442f8505869866f8bfdabd54dd7c8ac3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782444890", "to_ids": true, "type": "ssdeep", "uuid": "59f7a44d-71dc-4565-a033-75133225553f", "value": "192:gVlvdn0/9dBCAoT/S/nZe/x1/K/xgQCJNhN7:grvdG/sAoWQIuvt" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782444890", "to_ids": false, "type": "size-in-bytes", "uuid": "098e6c2f-f092-42ff-9899-218c211582ef", "value": "7078" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782444890", "to_ids": true, "type": "vhash", "uuid": "cf941839-4766-4d5a-adcd-f10f165efc24", "value": "768048fb3d93544d904fb7cabc2a43a1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782444890", "to_ids": true, "type": "filename", "uuid": "cda95f31-232d-47be-aa30-cf1c9a28965d", "value": "Sila semak bil anda..vbs" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 25/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782444890", "to_ids": false, "type": "text", "uuid": "8359807c-5f02-4d7b-97c8-c9b4491007ef", "value": "Type Description: VBA\nMicrosoft: TrojanDownloader:VBS/Obfuse.NWA!MTB\nVT Total Detection:30/61\nFirst Submission:2026-05-19T06:43:49.000000+00:00\nLast Submission:2026-05-19T06:43:49.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782447014", "uuid": "960d1fc6-076c-4e74-94d1-060b44746dab", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782447014", "to_ids": true, "type": "md5", "uuid": "b58c1443-c3d0-43bf-9f62-d698aeb33580", "value": "d43fdaa1f0ee09d7e5f0f94ee9df7b6c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782445612", "to_ids": true, "type": "sha1", "uuid": "da2ddc2a-979b-4024-bbbe-cb1ce8be0da0", "value": "a381022c93cb1452a74ac5d731543f9b53ed6501", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782445612", "to_ids": true, "type": "sha256", "uuid": "31e0787b-ce0a-4637-8fee-13aa4b7f99a5", "value": "02a7db29d35cf01ed94b6dfb14a7026bb2906d8fa9a99ef801040c52284cceb1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782444912", "to_ids": true, "type": "ssdeep", "uuid": "10a02170-ee02-42c5-9e6b-46fb7a2fe69e", "value": "96:eAVzuC0PVnzMQwb0x3PbRYVM2a7VwVwLZvT5Nh29n/6ZAO/LB5WYv:9A9Di0x/be3apwVuZ75nmn/MAO/So" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782444912", "to_ids": false, "type": "size-in-bytes", "uuid": "c2b60ab2-c6e4-4623-8052-ac66ae452a32", "value": "6494" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782444912", "to_ids": true, "type": "vhash", "uuid": "ef7716d6-e9f2-48be-a835-283a87cb1a32", "value": "da006606624330fb21d5d3cef1200ef2" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782444912", "to_ids": true, "type": "filename", "uuid": "94737632-791f-4877-aaec-5d16d25664ce", "value": "Bitte f\u00fcllen Sie das Formular f\u00fcr Umsatzsteuer-Nullsatz-Verk\u00e4ufe aus..vbs" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 24/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782444912", "to_ids": false, "type": "text", "uuid": "831e1750-753e-4794-98d5-2c94003c6a88", "value": "Type Description: VBA\nMicrosoft: Trojan:Script/Wacatac.B!ml\nVT Total Detection:26/60\nFirst Submission:2026-03-25T21:22:36.000000+00:00\nLast Submission:2026-03-25T21:22:36.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782447035", "uuid": "fcf87ddc-9468-4d5f-af60-2b31a2b7618c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782447035", "to_ids": true, "type": "md5", "uuid": "bc83758d-c1d8-4ea7-ae40-5dc5b2675325", "value": "dad708e050632a4280cabf98ac1376b7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782445613", "to_ids": true, "type": "sha1", "uuid": "292c90d7-c4e0-49f2-95a3-6a41470156e0", "value": "5b3394eecb3a3c1ab96baa3e6f5ff5b3a4578a5a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782445614", "to_ids": true, "type": "sha256", "uuid": "33eff929-d0cc-4e34-b2ff-b156c86916b1", "value": "3140c5bee192b0f125e188451a68b82199ee551dbab78c92d04711588c400669", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782444934", "to_ids": true, "type": "ssdeep", "uuid": "129e0a49-f3a8-438d-9336-da1ae9b183a6", "value": "384:OqXZ7vNO6lLuHGvELNnxGgQG7axPwc+ccU9LFoiD/ywmV/ylsl3J:TXPQRnxmo0Pw4KiD/8yWf" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782444934", "to_ids": false, "type": "size-in-bytes", "uuid": "a7251515-baec-44e8-8781-bdef7349ca6c", "value": "20694" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782444934", "to_ids": true, "type": "vhash", "uuid": "cd05154b-7077-414e-b9f2-9058ff0e8d10", "value": "d293a617c624f7939854321e963d897a" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782444934", "to_ids": true, "type": "filename", "uuid": "6ced716c-d718-4225-90dd-deba445a315b", "value": "Outstanding Balance Sheet.vbs.xls" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 24/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782444934", "to_ids": false, "type": "text", "uuid": "43c155b9-153f-4ec8-b4db-70dd0d62c112", "value": "Type Description: VBA\nMicrosoft: Trojan:Win32/Malgent\nVT Total Detection:29/60\nFirst Submission:2026-06-12T03:14:38.000000+00:00\nLast Submission:2026-06-12T03:14:38.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782447056", "uuid": "5c47be82-c33d-4819-9ae0-1b166a7df345", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782447056", "to_ids": true, "type": "md5", "uuid": "c45abbee-472e-45ef-be06-a6ac84af0acf", "value": "ddaffe9849f7f3c79f8804adb9a6b3d5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782445614", "to_ids": true, "type": "sha1", "uuid": "6edf4b78-c6dc-4938-ad75-19e41946100d", "value": "6cf65aa606e7f3b5c96c8af883ccd11cf826e61f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782445614", "to_ids": true, "type": "sha256", "uuid": "dae08705-8283-4e3f-ae0d-e7823f279a5c", "value": "28292b9822d83e28c0a5bb3befdd5b188be351314e9b3a1c2740702722999cfa", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782444956", "to_ids": true, "type": "ssdeep", "uuid": "195237eb-1cce-48e5-868f-f6f9c6b4d124", "value": "192:gyq0EQpu03DCDJuo/H/W/OUwD7xXr9VC8:g7wl2VKwD7xf/" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782444956", "to_ids": false, "type": "size-in-bytes", "uuid": "75c9c186-e6e3-4c50-a9b8-a860a7681149", "value": "6403" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782444956", "to_ids": true, "type": "vhash", "uuid": "ce5944f0-2e48-4506-8906-321dc40ff65d", "value": "4a960e3e5e9b8c6386157cec779286c2" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782444956", "to_ids": true, "type": "filename", "uuid": "ea3b39c4-cc57-4e57-ba2b-fd1a85b10001", "value": "kof.vbs" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 24/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782444956", "to_ids": false, "type": "text", "uuid": "db08002c-5c8b-4623-b1b3-d7c79aa78b2b", "value": "Type Description: VBA\nMicrosoft: Trojan:Script/Wacatac.B!ml\nVT Total Detection:28/60\nFirst Submission:2026-04-06T16:49:17.000000+00:00\nLast Submission:2026-04-06T16:49:17.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782447077", "uuid": "b1ad862e-00e5-4ddf-8434-06a3c1242b9f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782447077", "to_ids": true, "type": "md5", "uuid": "e6464661-2f13-405a-90d8-8a25ac0a8fa2", "value": "df4fa0369eaca5cec348be293890d4af", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782445615", "to_ids": true, "type": "sha1", "uuid": "5fc35707-d33d-47ac-9c29-ea0f9c06576f", "value": "2f44c64e0495432405e84b0961b32e2c82024f1c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782445615", "to_ids": true, "type": "sha256", "uuid": "989c3813-4dab-413f-b924-da444cf7c613", "value": "d36f50ecfb6a9104f235df7aefdbddab699495532ede9c79ef1a577dce359a90", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782444977", "to_ids": true, "type": "ssdeep", "uuid": "baea6662-4842-4590-99ac-18c7a2d1f838", "value": "1536:TemSOU5iXV4xGenEcbw9Bp6B5o2PpVcIjJ84tV:vARVPD1V" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782444977", "to_ids": false, "type": "size-in-bytes", "uuid": "9bb24310-0c11-473b-98d9-71a3c9bac395", "value": "61809" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782444977", "to_ids": true, "type": "vhash", "uuid": "c9dd04cb-01f0-4e74-b2ed-958290060bdb", "value": "e5db8e293c4b886b4742405bbb1e1f1e" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782444977", "to_ids": true, "type": "filename", "uuid": "c1dd90b1-f47d-434e-b2d3-e3b86bb42f96", "value": "Account Statement.vbs" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 24/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782444977", "to_ids": false, "type": "text", "uuid": "adfd0238-cf75-46bf-9f08-a00a643aa91a", "value": "Type Description: VBA\nMicrosoft: Trojan:Win32/Malgent\nVT Total Detection:28/60\nFirst Submission:2026-06-15T09:02:22.000000+00:00\nLast Submission:2026-06-15T09:02:22.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782447098", "uuid": "707171c6-4545-46db-98c3-5514538c9bbf", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782447098", "to_ids": true, "type": "md5", "uuid": "6e2bf061-01ec-4068-9f0a-b6a83b8ab0c4", "value": "f90ed4b2d0b67114aa89ddfed658e5c0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782445616", "to_ids": true, "type": "sha1", "uuid": "a9d54b0a-5cc7-485a-930b-ce539abc5478", "value": "d092e3010c7d891abe72118ae8282b881fe64845", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782445616", "to_ids": true, "type": "sha256", "uuid": "bf0ba347-892f-4785-a7e5-32ae9eb86eac", "value": "d982440caac644cacb638069e0583e1d6473706b3eeb70869abce2fb16295e9a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782444999", "to_ids": true, "type": "ssdeep", "uuid": "1c70009d-964e-468e-b5a0-d1908fda7ccc", "value": "96:YyWZ5VwNaDcNs6mt9jO9dtn0qDxVUL44T6rFjMarTzBW7igbE+Wc/7xnI:RWZ8rDmy9UOU04T6r9TzUzbE/c/7C" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782444999", "to_ids": false, "type": "size-in-bytes", "uuid": "2c273b19-afc2-44f4-b449-7f52b7de7b8e", "value": "6271" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782444999", "to_ids": true, "type": "vhash", "uuid": "f21045e1-44e6-4588-8d74-23b542a555fe", "value": "b47ea21cd16213290c35472cf21b7145" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782444999", "to_ids": true, "type": "filename", "uuid": "884bc1d9-d94c-4ebf-af73-998731bd6f24", "value": "dfjieya.vbs" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 24/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782444999", "to_ids": false, "type": "text", "uuid": "0de0e442-c160-4271-be53-94919cebc8a7", "value": "Type Description: VBA\nMicrosoft: None\nVT Total Detection:26/60\nFirst Submission:2026-05-19T09:04:38.000000+00:00\nLast Submission:2026-05-19T09:04:38.000000+00:00" } ] } ] } }